Re-vendor the canonical files from sneak/prompts at dd4027b (closes #121)

The vendored files are copies from sneak/prompts dd4027b, with this
repository's own entries after the canonical content. golangci-lint is
v2.14.0. Lint and test are phases of the Dockerfile, which script/lint
and script/test build with --no-cache; Dockerfile.lint and
script/lint-darwin are gone, and the lint phase also checks the macOS
build. The tests run on the Debian Go image with cgo and the race
detector. script/cibuild bootstraps, runs script/check and builds the
image; CHECK_EPOCH and the memlock ulimit are gone. Go's build cache
stays in a cache mount, out of the test image's layer. The rules in
CLAUDE.md that AGENTS.md lacked are now in AGENTS.md.

Model: opus-5-5

TODO.md

@@ -18,6 +18,17 @@ https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
+- 2026-10-07: The canonical files are re-vendored from `sneak/prompts` commit
+  `dd4027b` (https://git.eeqj.de/sneak/secret/issues/121), with golangci-lint
+  v2.14.0 in the lint phase. Lint and test are phases of the `Dockerfile`, and
+  `script/lint` and `script/test` each build one with `--no-cache`;
+  `Dockerfile.lint` and `script/lint-darwin` are gone, and the lint phase also
+  checks the macOS build. The tests run on the Debian Go image with cgo and the
+  race detector. `script/cibuild` bootstraps, runs `script/check` and builds the
+  image; `CHECK_EPOCH` and the memlock ulimit are gone. `--no-cache` starts Go's
+  build cache mount empty, so `make test` compiles everything on every run. The
+  rules in `CLAUDE.md` that `AGENTS.md` lacked are in `AGENTS.md`, and
+  `CLAUDE.md` is deleted.
 - 2026-10-06: `script/test` runs the tests with the race detector, a 30-second
   timeout per package and coverage, as `REPO_POLICIES.md` requires
   (https://git.eeqj.de/sneak/secret/issues/32). When they fail, it reruns them